[ CVE-2026-57231 · Published 26 Jun 2026 ]
Podman: Malformed Image can trick podman run into leaking host environment variables into the container
CVSS 7.5
EPSS <1%Fix available
[ Description ]Official description
Podman is a tool for managing OCI containers and pods. From 1.8.1 until 5.8.4, a container image that contains a environment variable with just a key and no value can trick podman into passing that variable from the host into the container. This is made worse by the fact that using an asterisk (*) will cause podman to pass all host variables into the container. So essentially a malicious image can exfiltrate all podman environment variables that are set in the session from where the container is launched. This vulnerability is fixed in 5.8.4 and 6.0.0.
[ Fixes ]Fixes and patches
- github.com/containers/podman/v5 5.8.4Fixed version · GitHub Advisories · go package github.com/containers/podman/v5: upgrade to 5.8.4 or later (affected < 5.8.4)
- go.podman.io/podman/v6 6.0.0Fixed version · GitHub Advisories · go package go.podman.io/podman/v6: upgrade to 6.0.0 or later (affected < 6.0.0)
[ Packages ]Affected open-source packages
- github.com/containers/podman/v5 goAffected < 5.8.4 · fixed in 5.8.4 · GHSA-4hq8-gpf5-8p68
- go.podman.io/podman/v6 goAffected < 6.0.0 · fixed in 6.0.0 · GHSA-4hq8-gpf5-8p68
- github.com/containers/podman/v4 goAffected <= 4.9.5 · GHSA-4hq8-gpf5-8p68
- github.com/containers/podman/v3 goAffected <= 3.4.7 · GHSA-4hq8-gpf5-8p68
- github.com/containers/podman/v2 goAffected <= 2.2.1 · GHSA-4hq8-gpf5-8p68
- github.com/containers/podman goAffected >= 1.8.1, < 5.8.4 · GHSA-4hq8-gpf5-8p68